A hard-coded API key in the Keygraph Shannon router component allows unauthenticated network attackers to perform unauthorized actions and intercept sensitive proxied traffic.

This vulnerability is a use of hard-coded credentials (CWE-798) where a static API key is embedded within the router configuration. The flaw is exploitable by unauthenticated network attackers who can reach the router port to proxy requests using the victim's upstream credentials.

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity. By proxying requests, attackers can gain unauthorized access to an organization's upstream provider API credentials, leading to potential financial costs, service abuse, and the disclosure of sensitive request and response data. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the Keygraph Shannon instance to the version containing commit 023cc953db742602964b7826105278d15c28a420 or later to remove the hard-coded credential.

Proactive Monitoring: Audit network traffic for unusual proxy requests originating from or directed to the Shannon instance and review API usage logs for anomalous activity.

Compensating Controls: Restrict network access to the router component by implementing firewall rules or access control lists that limit exposure to only trusted internal IP addresses.

Public Exploit Available: Unknown

Given the high-severity nature of this credential exposure, organizations utilizing Keygraph Shannon must prioritize the application of the vendor-provided security update. If an immediate update is not feasible, restrict network access to the affected component to mitigate the risk of unauthorized external access.